Code & supply chain
Your repositories read by a set of independent analyzers: what you wrote, what you depend on, and what runs on your machine at install time.
What people come here for
Dependency Vulnerabilities
The question most teams open a scanner for. Declared dependencies matched against known vulnerabilities by version range, with the remedy stated: an exact version to pin, or that no fix has been published.
Full definition →Malicious Packages
A compromised package does its work at install time. This resolves an install hook to the file it really executes, follows that package's own import graph, and raises severity only on combined signals — a native module using child_process is not by itself an accusation.
Full definition →Inter-procedural Taint Analysis
Follows untrusted input across files to the place it becomes dangerous and reports the path step by step, recognising sanitizers on the way. JavaScript and TypeScript only, and neither path- nor alias-sensitive.
Full definition →SBOM Generation
A CycloneDX 1.6 bill of materials validated against the official schema, with per-ecosystem package URLs — the artefact an enterprise customer or an auditor asks for by name. SPDX output is not available yet.
Full definition →Secrets & Keys
Finds secrets in the repository and tracks each one through five states, including the one that matters most: removed from the current tree but still sitting in the history. A key you deleted last year is still a key somebody can read.
Full definition →Everything else in this surface
Each name opens its own one-line definition in the capability catalogue.
What this does not do
Static analysis reads code, it does not run it. A clean result here means these analyzers found nothing with the methods described — not that the code is safe.
Everything this product does not do →